gitea-admin/CASAN
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactor(structure): promote app to repo root + remove redundant workspace cruft

Browse Source 
Standard production layout: the OKR app (was nested under AINative_OKR_CASAN5/) is now
the repository root. No more wrapper directory.

- Promote AINative_OKR_CASAN5/* -> repo root (backend/ frontend/ packages/ apps/
  .specify/ docs/ infra/ nginx/ scripts/ + configs). Merge tool dirs: .gitea (kept the
  active deploy ci.yml, added harness-ci.yml + runbooks), .claude (agents/commands +
  launch.json), .github moved up.
- Remove redundant: 00_SUBMISSION_PACKAGE, scattered root notes (FPT_CASAN_Full.md,
  tu-tuong-casan.md, casan-tu-sinh..., casan_harness_assessment.md, source-review...,
  README_CASAN5_REFINED.md), casan-next-plans/ and optimize-docs/ (competition/planning
  artifacts — roadmap + design history preserved in git log / commit messages).
- Update all references to the old layout:
  - .gitea/workflows/{ci,harness-ci}.yml, .github/workflows/{ci,deploy}.yml:
    working-directory .; drop AINative_OKR_CASAN5/ prefix; .specify/{tests,scripts}
    -> packages/casan-harness/... (.specify/logs state kept)
  - .claude/launch.json, .gitea/*-runbook.md: path prefixes
  - CLAUDE.md, README.md: docs/input -> apps/okr/domain/input
  - policy-bundle.yaml: 8 policy paths -> packages/casan-harness/...; manifest re-signed
- secrets-scan.sh: fixture excludes -> new package/domain paths.

Full gate from the new root: PASS=64 FAIL=0 SKIP=3.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
thanhnv
2026-07-08 13:26:36 +09:00
co-authored by Claude Opus 4.8
parent 7101af9fd4
commit 36a4812ef3
925 changed files with 410 additions and 18001 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/ci.yml
+19 -19
View File
@@ -10,9 +10,9 @@ concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
# All run steps execute inside AINative_OKR_CASAN5/ (the app directory).
# All run steps execute inside (the app directory).
# actions/* steps still reference $GITHUB_WORKSPACE root, so paths in `with:` blocks
# must include AINative_OKR_CASAN5/ prefix.
# must include prefix.
jobs:
# ──────────────────────────────────────────────────────────────────────────
@@ -24,7 +24,7 @@ jobs:
runs-on: ubuntu-latest
defaults:
run:
working-directory: AINative_OKR_CASAN5
working-directory: .
steps:
- name: Checkout
uses: actions/checkout@v3
@@ -34,7 +34,7 @@ jobs:
with:
node-version: "20"
cache: "npm"
cache-dependency-path: AINative_OKR_CASAN5/package-lock.json
cache-dependency-path: package-lock.json
- name: Install frontend dependencies
run: npm ci -w frontend
@@ -53,7 +53,7 @@ jobs:
needs: [frontend-tests]
defaults:
run:
working-directory: AINative_OKR_CASAN5
working-directory: .
env:
VAULT_ADDR: "http://vault:8200"
VAULT_TOKEN: ${{ secrets.VAULT_TOKEN }}
@@ -67,7 +67,7 @@ jobs:
with:
node-version: "20"
cache: "npm"
cache-dependency-path: AINative_OKR_CASAN5/package-lock.json
cache-dependency-path: package-lock.json
- name: Install test tools
run: |
@@ -82,31 +82,31 @@ jobs:
- name: Vault KMS — enable transit + pre-create keys
run: |
if curl -sf "$VAULT_ADDR/v1/sys/health" >/dev/null 2>&1; then
bash .specify/scripts/bash/vault-kms.sh enable-transit
bash .specify/scripts/bash/vault-kms.sh ensure-key casan-policy-key
bash .specify/scripts/bash/vault-kms.sh ensure-key casan-audit-key
bash packages/casan-harness/scripts/bash/vault-kms.sh enable-transit
bash packages/casan-harness/scripts/bash/vault-kms.sh ensure-key casan-policy-key
bash packages/casan-harness/scripts/bash/vault-kms.sh ensure-key casan-audit-key
echo "VAULT_KMS_READY"
else
echo "VAULT_KMS_SKIP (unreachable — will use local-file fallback)"
fi
- name: Run CASAN4 harness tests (35 tests)
run: bash .specify/tests/run-casan4-harness-tests.sh
run: bash packages/casan-harness/tests/run-casan4-harness-tests.sh
- name: Run adversarial harness tests (44 tests)
run: bash .specify/tests/adversarial-harness-tests.sh
run: bash packages/casan-harness/tests/adversarial-harness-tests.sh
- name: Sign audit chain head via Vault KMS (H5)
run: bash .specify/scripts/bash/sign-audit-head.sh
run: bash packages/casan-harness/scripts/bash/sign-audit-head.sh
- name: Sign policy bundle via Vault KMS (H5)
run: bash .specify/scripts/bash/sign-policy-bundle.sh sign
run: bash packages/casan-harness/scripts/bash/sign-policy-bundle.sh sign
- name: Verify audit chain (anchor=signed expected in CI)
run: bash .specify/scripts/bash/verify-audit-chain.sh
run: bash packages/casan-harness/scripts/bash/verify-audit-chain.sh
- name: Security gate — aggregate verdict (PASS=11 FAIL=0 SKIP=0)
run: bash .specify/scripts/bash/security-gate.sh
run: bash packages/casan-harness/scripts/bash/security-gate.sh
- name: Upload test evidence
if: always()
@@ -114,8 +114,8 @@ jobs:
with:
name: casan-evidence-${{ github.run_number }}
path: |
AINative_OKR_CASAN5/docs/output/casan/evidence/harness-test-report.md
AINative_OKR_CASAN5/docs/output/casan/evidence/
docs/output/casan/evidence/harness-test-report.md
docs/output/casan/evidence/
retention-days: 14
# ──────────────────────────────────────────────────────────────────────────
@@ -141,7 +141,7 @@ jobs:
#
# One-time CI runner setup:
# ssh ubuntu@161.33.149.243
# RUNNER_TOKEN=<from Gitea admin> bash AINative_OKR_CASAN5/scripts/setup-ci-runner.sh
# RUNNER_TOKEN=<from Gitea admin> bash scripts/setup-ci-runner.sh
# ──────────────────────────────────────────────────────────────────────────
deploy-okr:
name: "Build & Deploy OKR → /opt/webapps/okr"
@@ -150,7 +150,7 @@ jobs:
if: github.ref == 'refs/heads/main' && github.event_name == 'push'
defaults:
run:
working-directory: AINative_OKR_CASAN5
working-directory: .
env:
JWT_SECRET: ${{ secrets.JWT_SECRET }}
WEB_VPS: "ubuntu@161.33.139.73"
.gitea/workflows/harness-ci.yml
+37
View File
@@ -0,0 +1,37 @@
name: CASAN Harness CI
on:
push:
branches: [main]
pull_request:
branches: [main]
jobs:
harness:
runs-on: ci-runner
timeout-minutes: 45
env:
CASAN_CI_RUN_FRONTEND: "1"
CASAN_CI_RUN_INFRA_LAB: "0"
CASAN_GEN_MODE: "template"
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Install system dependencies
run: |
set -euo pipefail
if ! command -v node >/dev/null 2>&1; then
curl -fsSL https://deb.nodesource.com/setup_20.x | bash -
apt-get install -y nodejs
fi
node --version
npm --version
- name: Install npm dependencies
working-directory: .
run: npm ci
- name: Run CASAN harness gate
working-directory: .
run: bash packages/casan-harness/scripts/bash/ci-harness-gate.sh